Assign a token-owned unique id to every object and harden object find

src/crypto.c

@@ -266,6 +266,7 @@ static AttributeType attrType[] = {
     { CKA_TOKEN,                       ATTR_TYPE_DATA  },
     { CKA_PRIVATE,                     ATTR_TYPE_BOOL  },
     { CKA_LABEL,                       ATTR_TYPE_DATA  },
+    { CKA_UNIQUE_ID,                   ATTR_TYPE_DATA  },
     { CKA_APPLICATION,                 ATTR_TYPE_DATA  },
     { CKA_VALUE,                       ATTR_TYPE_DATA  },
     { CKA_OBJECT_ID,                   ATTR_TYPE_DATA  },
@@ -907,6 +908,13 @@ static CK_RV SetAttributeValue(WP11_Session* session, WP11_Object* obj,
     if (rv != CKR_OK)
         return rv;
 
+    /* CKA_UNIQUE_ID is generated and owned by the token; a caller may never
+     * supply or change it. Reject before any setter runs so a mixed template
+     * fails without mutating another attribute. */
+    for (i = 0; i < (int)ulCount; i++) {
+        if (pTemplate[i].type == CKA_UNIQUE_ID)
+            return CKR_ATTRIBUTE_READ_ONLY;
+    }
 
     type = WP11_Object_GetType(obj);
     objClass = WP11_Object_GetClass(obj);

src/internal.c

@@ -11613,6 +11613,23 @@ static int GetData(byte* data, CK_ULONG dataLen, byte* out, CK_ULONG* outLen)
     return ret;
 }
 
+static int GetUniqueId(WP11_Object* object, byte* data, CK_ULONG* len)
+{
+    byte str[24];
+    unsigned long handle = (unsigned long)object->handle;
+    int i = (int)sizeof(str);
+
+    /* Decimal ASCII of the token-assigned object handle. The handle is drawn
+     * from a monotonic per-token counter and persisted, so the value is unique
+     * per object and stable across reload. */
+    do {
+        str[--i] = (byte)('0' + (handle % 10));
+        handle /= 10;
+    } while (handle != 0 && i > 0);
+
+    return GetData(str + i, (CK_ULONG)(sizeof(str) - i), data, len);
+}
+
 static int GetCertAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type, byte* data,
                        CK_ULONG* len)
 {
@@ -12497,6 +12514,9 @@ int WP11_Object_GetAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type, byte* data,
         case CKA_LABEL:
             ret = GetData(object->label, object->labelLen, data, len);
             break;
+        case CKA_UNIQUE_ID:
+            ret = GetUniqueId(object, data, len);
+            break;
         case CKA_TOKEN:
             ret = GetBool(object->onToken, data, len);
             break;
@@ -13286,6 +13306,11 @@ int WP11_Object_MatchAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type,
     byte* ptr;
     CK_ULONG attrLen = len;
 
+    /* A NULL search value with a non-zero length cannot match any stored
+     * attribute and must not be dereferenced by the comparison below. */
+    if (data == NULL && len != 0)
+        return 0;
+
     /* Get the attribute data into the stack buffer if big enough. */
     if (len <= (int)sizeof(attrData)) {
         if (WP11_Object_GetAttr(object, type, attrData, &attrLen) == 0)

tests/include.am

@@ -250,6 +250,11 @@ noinst_PROGRAMS += tests/hbs_persistence_test
 tests_hbs_persistence_test_SOURCES = tests/hbs_persistence_test.c
 tests_hbs_persistence_test_LDADD =
 
+check_PROGRAMS += tests/unique_id_test
+noinst_PROGRAMS += tests/unique_id_test
+tests_unique_id_test_SOURCES = tests/unique_id_test.c
+tests_unique_id_test_LDADD =
+
 if BUILD_STATIC
 tests_pkcs11test_LDADD += src/libwolfpkcs11.la
 tests_pkcs11mtt_LDADD  += src/libwolfpkcs11.la
@@ -301,6 +306,7 @@ tests_logout_token_key_zero_test_LDADD += src/libwolfpkcs11.la
 tests_tpm_decode_bounds_test_LDADD += src/libwolfpkcs11.la
 tests_concurrent_destroy_object_test_LDADD += src/libwolfpkcs11.la
 tests_hbs_persistence_test_LDADD += src/libwolfpkcs11.la
+tests_unique_id_test_LDADD += src/libwolfpkcs11.la
 else
 tests_object_id_uniqueness_test_LDADD += src/libwolfpkcs11.la
 tests_empty_pin_store_test_LDADD += src/libwolfpkcs11.la
@@ -344,6 +350,7 @@ tests_logout_token_key_zero_test_LDADD += src/libwolfpkcs11.la
 tests_tpm_decode_bounds_test_LDADD += src/libwolfpkcs11.la
 tests_concurrent_destroy_object_test_LDADD += src/libwolfpkcs11.la
 tests_hbs_persistence_test_LDADD += src/libwolfpkcs11.la
+tests_unique_id_test_LDADD += src/libwolfpkcs11.la
 endif
 
 EXTRA_DIST += tests/unit.h \